Police suspect a 16-year-old was the main operator of KillSec, a ransomware group linked to around 1,000 suspected attacks worldwide. Authorities announced on Thursday that an international operation had seized the group's infrastructure and made three provisional arrests. The German-led Operation KillSwitch replaced the crew's leak site with a police seizure notice. The available information is incredibly fragmented. Europol said the 16-year-old was "the group's suspected main operator," but did not explicitly say this person was arrested. Spanish police announced the arrest of a "minor," a Romanian national residing in Spain, but did not publicly link this arrest to the 16-year-old mentioned by Europol. The US Department of Justice (DoJ) said UK police had arrested Dutch national Fouad Eltibrizi, whom it has charged over alleged cybercrimes in the US and Puerto Rico. It is seeking his extradition. Eltibrizi is the only suspect officials have publicly named. Europol told The Register he was allegedly one of KillSec's negotiators. Authorities have not named the suspected 16-year-old operator. Romanian police (Poliția Română) said a 24-year-old helped establish KillSec in October 2023, although other authorities date the group's formation to 2024. Their statement did not specify whether that person was arrested. Officials separately confirmed to The Register that a Romanian national in his twenties was arrested in Romania on suspicion of acting as a KillSec affiliate. Europol also identified a suspected developer who turned 18 in August and was a minor when some of the alleged offenses were committed. Spanish police referenced a woman who remains under investigation in connection to the case, but was not arrested. The coordinated raids took place on September 30, following investigations that began in early 2025. Ten police agencies from Europe and the US took part, with officers raiding eight properties across Greece, Romania, Spain, and the UK. Spanish police said officers raided a home and an office in an Alicante hotel, while Poliția Română searched four homes. Neither Greece nor the UK has released information about their involvement in the operation. Authorities secured at least 110 TB of data on KillSec's leak site against further unauthorized access. Investigators are examining seized devices and data to identify victims, attacks, and suspects, and trace the group's criminal proceeds. Over the course of the investigation, police took control of five central servers used to manage the group's activities and store victims' data. Security shops Bitdefender and Group-IB also supported the investigation. KillSec uses double extortion, encrypting victims' systems and threatening to publish stolen data unless they pay. Group-IB recently included KillSec, also referred to as "Kill Security" and "k1llsec," in its 2025 top 10 rankings for ransomware groups operating in APAC, LATAM, and the Middle East. The company's researchers said KillSec most commonly preyed on financial services and healthcare organizations, but was known to attack government entities and large enterprises. Group-IB said KillSec also offered stolen data for sale at prices ranging from $5,000 to $500,000. "Servers can be replaced in weeks; the people who build the platform and approve every attack cannot," said Group-IB CEO Dmitry Volkov. "Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end." KillSec initially offered a Windows encryptor before adding a version capable of encrypting VMware ESXi hosts, deleting data, shutting down VMs, and removing recovery points. ®

Spain’s data protection agency (AEPD) has reported the country’s first-ever personal data breach caused by the actions of an autonomous AI agent. Francisco Pérez Bes, president and deputy of the AEPD, said in a Monday blog post that an individual deployed an AI agent that used a “known large language model (LLM)” to carry out the attack on an organization. The agent scanned “generic files” before accessing the organization’s system, then ran vulnerability scans to find flaws that would give it read/write access to files containing personal data and invoices. Pérez Bes did not name the LLM used to support the attack, but said whoever was behind it used the agent to “successfully chain together different phases of the attack.” This demonstrates that AI-supported attacks are no longer theoretical, he added, and called on organizations to embrace defense tools that are capable of keeping pace with the speed at which agentic attacks can be executed. “Human supervision remains essential, but it must be supported by detection, containment, and response mechanisms capable of operating quickly enough,” said Pérez Bes (machine-translated). “The arrival of AI agents in the offensive arena should prompt an immediate review of security and data protection models. “Data protection officers, managers, and delegates must prepare for a scenario in which the speed of attacks will increase, but in which the same fundamentals will continue to be crucial: Understanding the processing activities, minimizing data, limiting access, correcting vulnerabilities, controlling suppliers, and being prepared to respond.” The Register asked AEPD for more information. Spain’s first AI agent attack comes as the AEPD recently recorded its busiest year for data protection complaints. According to its most recent annual report, covering 2025, the agency received 30,931 complaints – the most in its history – representing a 64 percent increase compared to the year before. And although Spain is only now getting its first taste of a security mishap caused by a naughty agent, cases involving the foremost US AI houses are already heavily documented. OpenAI’s claim in July that its agents escaped a sandbox and started attacking Hugging Face kickstarted something of a battle between it and rival Anthropic over whose agents could take the most liberties with their security. Both companies have reported several instances of their agents going rogue, escaping "secure" environments and going walkies across the internet to attack unwitting organizations. OpenAI has been circumspect about the true scale of its rogue agents’ damage, as third-party reporting showed more websites than it was letting on were taken over. Similarly, Anthropic has said that its AI agents had, in four cases now, accessed third-party systems in attacks that, if carried out by a human, could see them convicted under computer laws. ®

Texas utility CenterPoint Energy has confirmed that an attacker broke in and stole customer information through one of its internet-facing systems. The company disclosed the breach in a Form 8-K filing with the Securities and Exchange Commission after a post on a cybercrime forum claimed to offer its customer data. Houston-based CenterPoint, which serves around 7 million customers, said its electricity and gas services remain operational and undisrupted. "While the investigation remains ongoing, the company has determined that an unauthorized third party obtained personal information relating to a portion of the company's customers through one of the company's external-facing systems," the filing said. "The company is continuing to work with third-party experts to determine the scope of customers and personal information affected by the incident and intends to notify affected customers and regulatory authorities as required by applicable law. "The company reported the matter to law enforcement authorities and has notified certain regulatory authorities of the issue." The person claiming responsibility said they extracted 7.49 million of CenterPoint's files from a poorly secured API. Among the data allegedly available to download are customer names and contact details, billing data, move-in dates, driver's license information, and the last four digits of Social Security numbers. The Register has not independently verified the contents of the alleged data dump. When we asked CenterPoint for comment on the veracity of the claims, it told us: "Our filing speaks for itself." CenterPoint said it does not believe the incident is reasonably likely to materially affect its financial condition or results of operations. For operators of critical infrastructure, cyberattacks can lead to far worse outcomes. Recently, disruptive attacks have been recorded at facilities in Poland and the UK, and more than 100 US water systems were affected by attacks in July. The US consistently warns about the cyber threat facing utility providers from hostile states because successful attacks can disrupt essential services. ®

Someone compromised the official HBO Max Reddit account and used it to push more than 100 malicious ads serving up ClickFix attacks targeting both Windows and macOS devices with information-stealing malware. A Reddit user uncovered the infostealer ads on September 6, noting that the ad showed u/hbomax as the author — this is the verified HBO Max account — and advertised a macOS app for HBO Max. The streaming service does not offer a native client for the Mac. Anyone who clicked on the malicious ad would then be taken to a “somewhat-legitimate” looking landing page (hbomaxx[.]us) that includes a join/download button. Clicking the button produced instructions telling the user to copy and paste a command into Terminal on macOS. The Reddit security sleuth described that as “the classic infostealer/clickfix paste this command to download,” noting that they tested all of this in a sandboxed environment, and didn’t actually run the executable on their machine. “My guess is that the Reddit account is compromised,” they concluded. Three days later, Reddit paused the infostealer-dropping ads, and an admin said the social media platform’s safety and security teams were investigating what happened. HBO Max’s parent company Warner Bros. Discovery didn’t immediately respond to The Register’s inquiries about the account takeover - including who hijacked the streaming service’s Reddit account and how they did it. Maybe someone who didn’t like the House of the Dragon season 3 finale? We will update this story if and when we hear back. Researchers at Hudson Rock and ADAMnetworks analyzed the ads, and in a couple of reports said the HBO Max account hijacking was part of a “massive 48-hour malvertising blitz” that pushed 108 distinct ads using multiple software lures. They named the campaign PasteSwitch, and said it serves up targeted malware aimed at victims’ operating system - either macOS or Windows. The payloads include infostealers, malware loaders, cryptocurrency clippers, and fake cryptocurrency wallet applications. The cryptocurrency clippers - PasteSwitch delivers either AnimateClipper or ZigClipper - also provide blockchain-based command-and-control fallbacks for the attackers. They use Binance Smart Chain (BSC) contracts to dynamically fetch whatever C2 domain the crooks are using at any given time. “Between March and July 2026, researchers observed 36 mainnet changes executed by the same attacker controller address,” Hudson Rock said. “Because the C2 domain is hosted directly on the blockchain, the infrastructure demonstrates dynamic resilience, allowing the threat actors to easily rotate burned domains.” In addition to HBO Max, the attackers used developer-tool, disk-cleaner, and AI-themed lures, including fake OpenAI Codex ads, which crims have previously used to push Mac malware. Of the 108 ads, 46 used an HBO Max lure, directing app seekers to either hbomaxx[.]app or hbomax-macos[.]com. Another 36 tried to trick prospective victims via an OpenAI Codex theme (with a codex-craft[.]com) landing page. Of the rest: 15 purported to be a macOS disk utility (apple.clean-disk-guide[.]com) and 11 used other developer tools as lures (code-desktop[.]com). “The campaign proves once again why trusted distribution channels are becoming prime targets for infostealer delivery,” Hudson Rock co-founder and CTO Alon Gal said in a LinkedIn post. It also shows that miscreants continue to make heavy use of ClickFix attacks, so there’s little sign this social engineering method is going away anytime soon.®

The International Meteor Organization (IMO) is watching for fireballs again, but much of its website remains offline after a cyberattack that it says will take weeks to recover from. The Belgium-based nonprofit, which coordinates meteor observations and brings together amateur and professional astronomers worldwide, is currently serving visitors a stripped-down holding page explaining the outage. "We recently suffered a cyberattack that dealt a critical blow to aging infrastructure, taking much of our site offline," the organization said. "We expect several weeks of partial downtime as we transition to new infrastructure and services." IMO has not disclosed when the attack occurred, how the attackers gained access, or whether they accessed or encrypted any data. The organization collects reports from people who spot unusually bright meteors, or fireballs, and uses those observations to help document and analyze events. Its notice says it prioritized restoring that capability after the attack. "We prioritized restoring fireball reporting, and it is available again," IMO said. "If you saw a fireball or a bright light in the sky, you can still submit your observation." Other parts of the site remain unavailable while the organization rebuilds its infrastructure. IMO's warning that the process will take several weeks suggests this is more than a case of simply restoring a compromised web server, although the organization has not disclosed the extent of the damage. The incident also leaves some unanswered questions about the data held on the affected systems. IMO operates services used by meteor observers and members around the world, but has not said whether information belonging to users or contributors was exposed during the attack. The Register asked IMO when the attack occurred, which systems were affected, whether any data was compromised, and whether it has identified who was responsible, but has not yet received a response. IMO is used to documenting things that burn up spectacularly. It probably didn't expect its IT infrastructure to join them. ®

Crypto hardware wallet maker Trezor says the third-party email service provider it uses to send newsletters has been breached, and customers are now being sent phishing messages. There is good and bad news. The good news is that the emails appear easy to spot. They are not bespoke to each recipient and resemble a spray-and-pray campaign rather than sophisticated targeting that uses customer-specific data to enhance the email's perceived authenticity. All known examples of the scam email are titled "Critical Security Alert: STM32 Entropy Vulnerability," and the body explains that an estimated one in four Trezor devices are affected by a "hardware factory defect." The email warns customers that wallet seeds are exposed to brute-force attacks due to "insufficient randomness" and a "critically low 40-bit entropy." The email asks recipients to share their wallet backups. Trezor said: "Do not click it or interact with it. Never enter your wallet backup anywhere. Always confirm every action with your Trezor physically." The bad news is that because the attackers allegedly compromised the legitimate email provider, the messages can pass authentication checks and bypass some of the usual protections deployed by receiving email services. According to those who have shared copies of the emails, they appear to be sent from "mailing@trezor.io." Trezor has issued the warning across its social media channels and Trezor Suite, the companion app for its hardware wallets. The Register asked Trezor for more information. The third party email provider Brevo – formerly known as Sendinblue – said in a statement that a "security incident" had "allowed an attacker to access 120 Brevo accounts." It added that the "bad actor used the access to send phishing emails to the client's contactbase," and promised a "full post mortem later today." Swiss hardware wallet maker BitBox also appears to be affected, having shared an image of an email nearly identical to the one targeting Trezor's newsletter subscribers. The email similarly warns of entropy weaknesses affecting BitBox devices, although it is titled slightly differently: "Critical Security Alert: Microcontroller Entropy Bug Identified." The company said on X: "Our preliminary review of the phishing mail that was sent out to our newsletter subscribers about an hour ago found that it is very likely that our newsletter provider got compromised. "Multiple other Bitcoin companies got targeted as well, and it appears that we all share the same newsletter provider. "We sent out a phishing warning to all our newsletter subscribers, contacted the provider and reported the phishing domains. Most of the phishing links appear to have been taken down already. "We are still actively investigating this situation and will update you once we know more." Crypto tax and portfolio-tracking company CoinTracking also disclosed the compromise of its third-party email provider, which it named as Brevo, around the same time as Trezor and BitBox. CoinTracking shared a copy of the phishing email targeting its users and, since it does not offer hardware wallets, the message uses a different lure, asking customers to follow a link to refresh their API keys. Tough times in Trezorland The latest security snafu comes less than a month after Trezor announced that thousands of customers' details had been compromised following a breach at logistics partner ShipMonk. The hardware vendor initially estimated that around 13,000 people were affected. Those who ordered Trezor products between May 10 and August 8 had their names, email addresses, phone numbers, and shipping addresses breached. Compounding the problem for a company whose brand centers on security, Trezor confirmed on September 4 that the total number of affected customers had risen to 80,000. Trezor said ShipMonk later informed it that an additional 67,000 US customers who purchased products between November 2019 and August 2021 were affected. "Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications," said Trezor. "We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems." ®

The ringleader of a sprawling cybercrime operation has pleaded guilty in the US after helping to steal and launder hundreds of millions of dollars in cryptocurrency. Malone Lam, 22, a Singaporean national and Miami resident, spearheaded the scheme to steal cryptocurrency from wealthy individuals between October 2023 and May 2025. He first visited the US in 2023 after meeting two of the group's earliest alleged members – Jeandiel Serrano and Veer Chetal – while playing Minecraft online. Lam performed various functions within the group, although court documents [PDF] identify victim selection and social engineering support as his principal roles. The ringleader was responsible for obtaining databases of high-net-worth individuals who had cryptocurrency holdings to inform the group's targeting. He would also trigger account access notifications on victims' devices to convince them that their accounts were under attack. He was also involved in laundering the proceeds through exchanges that, according to court documents, had lax KYC requirements. Other group members carried out the social engineering calls, claiming to represent Google, Yahoo, Coinbase, Gemini (the crypto exchange, not the AI chatbot), and other online platforms. Their job was to convince victims to surrender personal information and "access codes" that could be used to access their accounts. Once they secured access, Lam's crew would look for cryptocurrency accounts, seed phrases, and passwords they could use to steal victims' assets. In most cases, social engineering techniques were enough to meet the thieves' goals, although in one case involving a victim who stored their holdings in a hardware wallet, Lam's gang arranged for Marlon Ferro to physically break into a house and steal it. The Register covered Ferro's sentencing earlier this year. He was brought into Lam's fold when he was just a teenager, tasked with carrying out multiple burglaries across the US when remote social engineering attacks lacked the necessary reach. During the crew's nearly two-year operation, its members stole hundreds of millions of dollars' worth of cryptocurrency. The individual thefts ranged from about $800,000 to tens of millions of dollars, while one victim lost more than $245 million, according to court documents. Lam's crew, allegedly comprising at least 12 individuals, knew how to spend their illicit gains. Prosecutors claim they splurged up to $500,000 on a single evening at a nightclub, dished out handbags worth tens of thousands of dollars to partygoers, and bought luxury clothing and watches priced between $100,000 and $500,000. They rented expensive properties in Miami, Los Angeles, and the Hamptons, chartered private jets, hired a team of private bodyguards, and splashed out on exotic cars, with some worth up to $3.8 million. Lam was arrested at a rented property in Miami on September 18, 2024. His sentencing hearing has not yet been scheduled. The court has set a status hearing for December 8. Lam pleaded guilty to one count of participating in a racketeering conspiracy, an offense carrying a maximum sentence of 20 years in prison. "If you build a cybercrime empire, we will find you, dismantle your operation, and hold you accountable," said US Attorney Jeanine Ferris Pirro. "This defendant led an international network that preyed on victims through deception, invaded their privacy, and stole hundreds of millions of dollars in cryptocurrency. "Working with our partners at the FBI and IRS-CI, we will continue to hunt down the criminals who weaponize technology to steal from innocent people." ®

Security researcher Scott Helme says his analysis supports FulcrumSec's claim that Manchester Airports Group (MAG) exposed privileged API keys in client-side JavaScript. Helme says he reached that conclusion after using information provided by the cyber extortion group to reconstruct how data belonging to roughly 8.8 million MAG customers was allegedly stolen last month. The crooks behind the attack described MAG's security failure as "tragi-comical." They claimed MAG exposed overprivileged API keys for Iterable, a marketing automation platform, in front-end JavaScript served by the websites of MAG's three airports: Manchester, Stansted, and East Midlands. Helme used the Internet Archive's Wayback Machine to retrieve older versions of the JavaScript and found that the three keys first appeared across the airport websites in June and July 2022. The same values remained exposed until August 2026, he said. "Read the timeline the other way round and it's worse," said Helme. "Anyone who looked at that page source on any day between June 2022 and August 2026 could have taken the key. FulcrumSec just happen to be the ones who told us. "There is no way to know, from the outside, who else did, and the honest answer is that MAG can't know either without going back through four years of Iterable API logs, if they even have four years of Iterable API logs." The API keys were not embedded directly in the HTML, Helme explained, but anyone who examined the JavaScript bundles loaded by the sites could find them. This would explain how the vulnerability could go unnoticed by the airport's IT teams for over four years. Helme says the browser-delivered code was using the keys to authorize server-side API operations – something Iterable's documentation explicitly warns against. The requests should instead have passed through MAG's own servers, where the credentials could be kept secret and access restricted. MAG's alleged exposure of the credentials was not the only issue at play. The keys were vastly overprivileged for their intended job, which was to attribute page clicks to marketing emails, Helme said. The keys had read/write access to core Iterable endpoints, giving anyone who obtained them the ability to access data such as customer profiles, parking and lounge bookings, and Fast Track purchases. Helme said the structure and contents of the stolen data indicated that it had been exported from Iterable. He said he also found that the keys could access endpoints capable of deleting customer records and lists or rewriting profiles. "There's no indication FulcrumSec did any of this, and I'm glad, but they could have just nuked everything from orbit and MAG would have been really screwed," said Helme. "For four whole years, the capability to delete Manchester Airports Group's database was a view-source away. "This wasn't only a confidentiality exposure. It was a colossal integrity and availability exposure too, and MAG just got lucky. How do they now trust any of the data that remains in the database?" When it disclosed the incident, MAG described the cyberattack as "sophisticated" and said it was "a hack, not a lapse." The company declined to comment on Helme's conclusions. MAG is continuing its investigation alongside the Information Commissioner's Office (ICO) and supporting the National Crime Agency with its inquiries. It is understood that MAG maintains it was the victim of a crime and disputes Helme's "no hacking required" characterization. FulcrumSec released the company's data on September 2, a week after MAG confirmed it had refused to pay. According to the ICO, the group's extortion demand was lower than those typically made by cybercriminals. ®

CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Still, the ransomware biz’s expanding operations, unique payload, and white-label hacking service make it one to watch, and a few recent analyses provide tips for defenders to keep the crooks out of their IT environments. Rakesh Krishnan, a threat-intel analyst who writes about cybercrime investigations on TheRavenFile blog, was one of the first researchers to publish details about CRPx0 at the beginning of the month, including previously unreleased malware samples. The operators offer a hacking service, providing “complete database extraction” from victim organizations and “optional public leak coordination upon request.” This platform also advertises full network compromise, “from initial access, through lateral movement, to full domain compromise,” plus persistent access across the victim’s infrastructure. A second, white-label, ransomware-as-a-service platform makes it really easy for wannabe crooks to get into the data-theft and extortion biz. CRPx0 builds, deploys, and configures everything from command-and-control infrastructure to the negotiation panel and malware, allowing its criminal customers to bring their own brand identity to their operations - and originally offered these services for a $10,000 one-time fee. At first, the operators promised to allow affiliates to keep 100 percent of their profits - this is unheard of in ransomware-as-a-service operations. This has since shifted to a 70-30 model, with affiliates receiving 70 percent of the extortion payments (after a one-time $333 enrollment fee) and the remaining 30 percent going to the operators. CRPx0 rules prohibit affiliates from infecting Commonwealth of Independent States (CIS) member countries and organizations based in these countries. This is a pretty common rule among Russia-based ransomware operations, and in an earlier interview with The Register, Recorded Future threat intelligence analyst Allan Liska called it the “first rule of ransomware club: you don't attack organizations in the Commonwealth of Independent States.” The gang also prefers Monero (XMR) payments, rather than Bitcoin (BTC). ClickFix ransomware delivery Affiliates can also customize their own ClickFix payload delivery. The operators offer two lures, a fake Windows Update and a fake Google reCAPTCHA, to socially engineer victims into executing the initial command, according to a Ransom-ISAC research team analysis published on Thursday. The Windows lure tricks a victim into pasting a PowerShell command into the Run dialog. This drops a DLL stager chain and ultimately deploys Python-based ransomware. The macOS lure, however, uses a curl|bash command that downloads portable Python and the ransomware directly. The lures and the rest of CRPx0’s malware run on Windows and macOS, and according to the researchers, there are four payload formats: “the two HTML lures plus a standalone DLL and a standalone EXE, both of which discard the social engineering step entirely.” All four deliver the same ransomware: a 1,769-line Python script that steals high-value files before encrypting them with AES-128-CBC (Fernet). The malware moves laterally via WMI/schtasks, and delivers a ransom note that gives victims a 48-hour deadline to pay up - or see their files leaked. 'Complete, professional offensive control center' On August 23, the CRPx0 operators published a v3.0 update note on the group’s clearnet leak site, promising “a complete, professional offensive control center for managing compromised remote machines from a single web dashboard.” It provides crims with tools to steal valuable files, credentials, and wallet recovery phrases and keys, while “watching stolen cryptocurrency wallet addresses flow in.” This service also provides scripts to run remote commands, and the control panel sets up “automated attack reactions that fire on their own when something valuable happens on a target.” As the operators note: “Everything is built to be operated by a human with no technical background: point-and-click panels, plain-language rules, and clear status indicators. The underlying attack engine is hidden behind a clean, dark-themed interface.” CRPx0’s hacking and ransomware services, enabling everything from crypto theft to encryptors and full network compromise, “could be a strategic move to attract new recruits, or a scam targeting a range of affiliate hopefuls seeking cybercrime services,” according to an August 12 analysis from Jade Brown, a threat researcher at Bitdefender. What defenders should do Still, “other threat actors may attempt to adopt similar techniques,” she warns. “This is a reminder that organizations should balance detection capabilities in preparation for different types of compromises, configuring technologies to detect and block malicious behavior that aligns with both crypto theft and encryption processes.” The Ransomware-ISAC team says defenders should prioritize five actions, in this order. “The first three cost nothing and blunt the entire ClickFix class of attack, not just CRPx0,” they note. First: remove the Run dialog for standard users - this will entirely block the Windows path. For macOS users: restrict Terminal via MDM for non-technical staff. Next, the threat-intel analysts advise defenders to alert on RunMRU writes containing powershell, curl or long base64 strings. “Every ClickFix victim leaves a trace at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU,” they wrote. “This is the highest-fidelity ClickFix detection available and it is trivial to deploy.” The team also lists adversary network indicators and suggests blocking those. Make sure to hunt for indicators and malicious behavior in the pre-encryption exfiltration window. “Data leaves before a single file is encrypted, so .crpx0 extensions and ransom notes are a post-mortem indicator, not a warning,” according to the Ransomware-ISAC. Finally, confirm backups are unreachable from the account that would be compromised, and treat anything reachable with the victim's credentials as destroyed. ®